<!DOCTYPE html>



  


<html class="theme-next muse use-motion" lang="zh-Hans">
<head>
  <meta charset="UTF-8"/>
<meta http-equiv="X-UA-Compatible" content="IE=edge" />
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1"/>
<meta name="theme-color" content="#222">









<meta http-equiv="Cache-Control" content="no-transform" />
<meta http-equiv="Cache-Control" content="no-siteapp" />
















  
  
  <link href="/lib/fancybox/source/jquery.fancybox.css?v=2.1.5" rel="stylesheet" type="text/css" />







<link href="/lib/font-awesome/css/font-awesome.min.css?v=4.6.2" rel="stylesheet" type="text/css" />

<link href="/css/main.css?v=5.1.3" rel="stylesheet" type="text/css" />


  <link rel="apple-touch-icon" sizes="180x180" href="/images/apple-touch-icon.png?v=5.1.3">


  <link rel="icon" type="image/png" sizes="32x32" href="/images/favicon-32x32.png?v=5.1.3">


  <link rel="icon" type="image/png" sizes="16x16" href="/images/favicon-16x16.png?v=5.1.3">


  <link rel="mask-icon" href="/images/logo.svg?v=5.1.3" color="#222">





  <meta name="keywords" content="DNS,DHCP," />





  <link rel="alternate" href="/atom.xml" title="大牙的杂货铺" type="application/atom+xml" />






<meta name="description" content="Dnsmasq 提供 DNS 缓存和 DHCP服务、Tftp服务功能。作为域名解析服务器(DNS)，dnsmasq可以通过缓存 DNS 请求来提高对访问过的网址的连接速度。作为DHCP 服务器，Dnsmasq 可以用于为局域网电脑分配内网ip地址和提供路由。DNS和DHCP两个功能可以同时或分别单独实现。Dnsmasq">
<meta name="keywords" content="DNS,DHCP">
<meta property="og:type" content="article">
<meta property="og:title" content="利用Dnsmasq搭建本地自有DNS服务器">
<meta property="og:url" content="http://linuxgeeks.github.io/2018/01/16/2018-01-16-161310-利用Dnsmasq搭建本地自有DNS服务器/index.html">
<meta property="og:site_name" content="大牙的杂货铺">
<meta property="og:description" content="Dnsmasq 提供 DNS 缓存和 DHCP服务、Tftp服务功能。作为域名解析服务器(DNS)，dnsmasq可以通过缓存 DNS 请求来提高对访问过的网址的连接速度。作为DHCP 服务器，Dnsmasq 可以用于为局域网电脑分配内网ip地址和提供路由。DNS和DHCP两个功能可以同时或分别单独实现。Dnsmasq 轻量且易配置，适用于个人用户或少于50台主机的网络。此外它还自带了一个 PXE">
<meta property="og:locale" content="zh-Hans">
<meta property="og:updated_time" content="2018-02-09T12:03:40.312Z">
<meta name="twitter:card" content="summary">
<meta name="twitter:title" content="利用Dnsmasq搭建本地自有DNS服务器">
<meta name="twitter:description" content="Dnsmasq 提供 DNS 缓存和 DHCP服务、Tftp服务功能。作为域名解析服务器(DNS)，dnsmasq可以通过缓存 DNS 请求来提高对访问过的网址的连接速度。作为DHCP 服务器，Dnsmasq 可以用于为局域网电脑分配内网ip地址和提供路由。DNS和DHCP两个功能可以同时或分别单独实现。Dnsmasq 轻量且易配置，适用于个人用户或少于50台主机的网络。此外它还自带了一个 PXE">



<script type="text/javascript" id="hexo.configurations">
  var NexT = window.NexT || {};
  var CONFIG = {
    root: '/',
    scheme: 'Muse',
    version: '5.1.3',
    sidebar: {"position":"left","display":"post","offset":12,"b2t":false,"scrollpercent":false,"onmobile":true},
    fancybox: true,
    tabs: true,
    motion: {"enable":true,"async":false,"transition":{"post_block":"fadeIn","post_header":"slideDownIn","post_body":"slideDownIn","coll_header":"slideLeftIn","sidebar":"slideUpIn"}},
    duoshuo: {
      userId: '0',
      author: '博主'
    },
    algolia: {
      applicationID: '',
      apiKey: '',
      indexName: '',
      hits: {"per_page":10},
      labels: {"input_placeholder":"Search for Posts","hits_empty":"We didn't find any results for the search: ${query}","hits_stats":"${hits} results found in ${time} ms"}
    }
  };
</script>



  <link rel="canonical" href="http://linuxgeeks.github.io/2018/01/16/2018-01-16-161310-利用Dnsmasq搭建本地自有DNS服务器/"/>





  <title>利用Dnsmasq搭建本地自有DNS服务器 | 大牙的杂货铺</title>
  








</head>

<body itemscope itemtype="http://schema.org/WebPage" lang="zh-Hans">

  
  
    
  

  <div class="container sidebar-position-left page-post-detail">
    <div class="headband"></div>
	
	<a href="https://github.com/mengdaya"><img style="position: absolute; top: 0; right: 0; border: 0;" src="https://camo.githubusercontent.com/38ef81f8aca64bb9a64448d0d70f1308ef5341ab/68747470733a2f2f73332e616d617a6f6e6177732e636f6d2f6769746875622f726962626f6e732f666f726b6d655f72696768745f6461726b626c75655f3132313632312e706e67" alt="Fork me on GitHub" data-canonical-src="https://s3.amazonaws.com/github/ribbons/forkme_right_darkblue_121621.png"></a>

    <header id="header" class="header" itemscope itemtype="http://schema.org/WPHeader">
      <div class="header-inner"><div class="site-brand-wrapper">
  <div class="site-meta ">
    

    <div class="custom-logo-site-title">
      <a href="/"  class="brand" rel="start">
        <span class="logo-line-before"><i></i></span>
        <span class="site-title">大牙的杂货铺</span>
        <span class="logo-line-after"><i></i></span>
      </a>
    </div>
      
        <p class="site-subtitle"></p>
      
  </div>

  <div class="site-nav-toggle">
    <button>
      <span class="btn-bar"></span>
      <span class="btn-bar"></span>
      <span class="btn-bar"></span>
    </button>
  </div>
</div>

<nav class="site-nav">
  

  
    <ul id="menu" class="menu">
      
        
        <li class="menu-item menu-item-home">
          <a href="/" rel="section">
            
              <i class="menu-item-icon fa fa-fw fa-home"></i> <br />
            
            首页
          </a>
        </li>
      
        
        <li class="menu-item menu-item-tags">
          <a href="/tags/" rel="section">
            
              <i class="menu-item-icon fa fa-fw fa-tags"></i> <br />
            
            标签
          </a>
        </li>
      
        
        <li class="menu-item menu-item-categories">
          <a href="/categories/" rel="section">
            
              <i class="menu-item-icon fa fa-fw fa-th"></i> <br />
            
            分类
          </a>
        </li>
      
        
        <li class="menu-item menu-item-archives">
          <a href="/archives/" rel="section">
            
              <i class="menu-item-icon fa fa-fw fa-archive"></i> <br />
            
            归档
          </a>
        </li>
      
        
        <li class="menu-item menu-item-about">
          <a href="/about/" rel="section">
            
              <i class="menu-item-icon fa fa-fw fa-user"></i> <br />
            
            关于
          </a>
        </li>
      
        
        <li class="menu-item menu-item-commonweal">
          <a href="/404/" rel="section">
            
              <i class="menu-item-icon fa fa-fw fa-heartbeat"></i> <br />
            
            公益404
          </a>
        </li>
      

      
        <li class="menu-item menu-item-search">
          
            <a href="javascript:;" class="popup-trigger">
          
            
              <i class="menu-item-icon fa fa-search fa-fw"></i> <br />
            
            搜索
          </a>
        </li>
      
    </ul>
  

  
    <div class="site-search">
      
  <div class="popup search-popup local-search-popup">
  <div class="local-search-header clearfix">
    <span class="search-icon">
      <i class="fa fa-search"></i>
    </span>
    <span class="popup-btn-close">
      <i class="fa fa-times-circle"></i>
    </span>
    <div class="local-search-input-wrapper">
      <input autocomplete="off"
             placeholder="搜索..." spellcheck="false"
             type="text" id="local-search-input">
    </div>
  </div>
  <div id="local-search-result"></div>
</div>



    </div>
  
</nav>



 </div>
    </header>

    <main id="main" class="main">
      <div class="main-inner">
        <div class="content-wrap">
          <div id="content" class="content">
            

  <div id="posts" class="posts-expand">
    

  

  
  
  

  <article class="post post-type-normal" itemscope itemtype="http://schema.org/Article">
  
  
  
  <div class="post-block">
    <link itemprop="mainEntityOfPage" href="http://linuxgeeks.github.io/2018/01/16/2018-01-16-161310-利用Dnsmasq搭建本地自有DNS服务器/">

    <span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
      <meta itemprop="name" content="孟庆宇">
      <meta itemprop="description" content="">
      <meta itemprop="image" content="/images/avatar.jpg">
    </span>

    <span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
      <meta itemprop="name" content="大牙的杂货铺">
    </span>

    
      <header class="post-header">

        
        
          <h1 class="post-title" itemprop="name headline">利用Dnsmasq搭建本地自有DNS服务器</h1>
        

        <div class="post-meta">
          <span class="post-time">
            
              <span class="post-meta-item-icon">
                <i class="fa fa-calendar-o"></i>
              </span>
              
                <span class="post-meta-item-text">发表于</span>
              
              <time title="创建于" itemprop="dateCreated datePublished" datetime="2018-01-16T16:13:10+08:00">
                2018-01-16
              </time>
            

            

            
          </span>

          
            <span class="post-category" >
            
              <span class="post-meta-divider">|</span>
            
              <span class="post-meta-item-icon">
                <i class="fa fa-folder-o"></i>
              </span>
              
                <span class="post-meta-item-text">分类于</span>
              
              
                <span itemprop="about" itemscope itemtype="http://schema.org/Thing">
                  <a href="/categories/Services/" itemprop="url" rel="index">
                    <span itemprop="name">Services</span>
                  </a>
                </span>

                
                
              
            </span>
          

          
            
          

          
          

          
            <span class="post-meta-divider">|</span>
            <span class="page-pv"><i class="fa fa-file-o"> 本文总阅读量</i>
            <span class="busuanzi-value" id="busuanzi_value_page_pv" ></span>次
            </span>
          

          
            <div class="post-wordcount">
              
                
                <span class="post-meta-item-icon">
                  <i class="fa fa-file-word-o"></i>
                </span>
                
                  <span class="post-meta-item-text">字数统计&#58;</span>
                
                <span title="字数统计">
                  7,450
                </span>
              

              
                <span class="post-meta-divider">|</span>
              

              
                <span class="post-meta-item-icon">
                  <i class="fa fa-clock-o"></i>
                </span>
                
                  <span class="post-meta-item-text">阅读时长 &asymp;</span>
                
                <span title="阅读时长">
                  32
                </span>
              
            </div>
          

          

        </div>
      </header>
    

    
    
    
    <div class="post-body" itemprop="articleBody">

      
      

      
        <p><a href="http://www.thekelleys.org.uk/dnsmasq/doc.html" target="_blank" rel="noopener">Dnsmasq</a> 提供 DNS 缓存和 DHCP服务、Tftp服务功能。作为域名解析服务器(DNS)，dnsmasq可以通过缓存 DNS 请求来提高对访问过的网址的连接速度。作为DHCP 服务器，Dnsmasq 可以用于为局域网电脑分配内网ip地址和提供路由。DNS和DHCP两个功能可以同时或分别单独实现。Dnsmasq 轻量且易配置，适用于个人用户或少于50台主机的网络。此外它还自带了一个 PXE 服务器以及对邮件服务器的 mx 记录的支持，jabber 的 srv 记录的支持等。它提供的 DNS 功能和可选择的 DHCP 功能可以取代 dhcpd 服务和 bind 等服务，配置起来更简单，更适用于虚拟化和大数据环境的部署。</p>
<h1 id="Dnsmasq-的应用"><a href="#Dnsmasq-的应用" class="headerlink" title="Dnsmasq 的应用"></a>Dnsmasq 的应用</h1><p>一般情况下，我们可以用 bind 解决 dns 的问题， dhcpd 解决 dhcp 的问题，可用dnsmasq解决下面的一些维护问题：</p>
<ul>
<li><p>局域网有很多机器希望使用一致的hosts文件，你需要经常维护这份列表。</p>
</li>
<li><p>你希望局域网的人访问某个域名时，拦截下来到指定的ip，做缓存节省带宽或者其它用途都可以。优先使用本地自定义dns。</p>
</li>
<li><p>阻止对某个域名的正常解析。</p>
</li>
</ul>
<p>常见的应用：</p>
<ul>
<li>同时提供 DNS 解析功能和 DHCP 地址分配功能，可用于机房内网、公司内网、家庭内网等类似内网环境</li>
<li>架设本地 DNS，在一定程度上，解决我们访问网速、广告拦截的问题</li>
<li>作为局域网机器批量IP维护使用，以及局域网解决特定网址域名禁止访问</li>
</ul>
<h1 id="Dnsmasq-基本的工作原理"><a href="#Dnsmasq-基本的工作原理" class="headerlink" title="Dnsmasq 基本的工作原理"></a>Dnsmasq 基本的工作原理</h1><p>Dnsmasq在接受到用户的一个DNS请求时，首先会查找 <code>/etc/hosts</code> 这个文件，然后查找 <code>/etc/resolv.conf</code> 中定义的外部 DNS 。所以说 Dnsmasq 是一个很不错的外部 DNS 中继。</p>
<p>配置 Dnsmasq 为 DNS 缓存服务器，同时在 <code>/etc/hosts</code> 文件中加入本地内网解析，这样一来每当内网机器查询时就会优先查询 hosts 文件，这就等于将 <code>/etc/hosts</code> 共享给全内网机器使用，从而解决内网机器互相识别的问题。相比逐台机器编辑 hosts 文件或者添加 Bind DNS 记录，仅编辑一个 hosts 文件，这简直太容易了。</p>
<h1 id="安装-Dnsmasq"><a href="#安装-Dnsmasq" class="headerlink" title="安装 Dnsmasq"></a>安装 Dnsmasq</h1><ul>
<li>rpm包安装</li>
</ul>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br></pre></td><td class="code"><pre><span class="line">yum -y install dnsmasq</span><br><span class="line"><span class="comment"># 使用yum源安装</span></span><br><span class="line"></span><br><span class="line">dnsmasq -v</span><br><span class="line"><span class="comment"># 查看dnsmasq的版本</span></span><br><span class="line"></span><br><span class="line">systemctl <span class="built_in">enable</span> dnsmasq</span><br><span class="line"><span class="comment"># 加入开机启动服务</span></span><br><span class="line"></span><br><span class="line">systemctl daemon-reload</span><br><span class="line">systemctl start dnsmasq</span><br><span class="line"><span class="comment"># 启动dnsmasq服务</span></span><br></pre></td></tr></table></figure>
<ul>
<li>源码包安装</li>
</ul>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br></pre></td><td class="code"><pre><span class="line">wget http://www.thekelleys.org.uk/dnsmasq/dnsmasq-2.78.tar.xz</span><br><span class="line"><span class="comment"># 下载源码包</span></span><br><span class="line"></span><br><span class="line">tar xf dnsmasq-2.78.tar.xz </span><br><span class="line"><span class="built_in">cd</span> dnsmasq-2.78</span><br><span class="line"><span class="comment"># 源码包解压</span></span><br><span class="line"></span><br><span class="line">vim Makefile <span class="comment"># 修改 PREFIX = /usr/local/dnsmasq</span></span><br><span class="line"><span class="comment"># 配置安装路径</span></span><br><span class="line"></span><br><span class="line">make &amp;&amp; make install</span><br><span class="line"><span class="comment"># 编译安装</span></span><br><span class="line"></span><br><span class="line">cp dnsmasq.conf.example /etc/dnsmasq.conf</span><br><span class="line"><span class="comment"># 生成配置文件</span></span><br><span class="line"></span><br><span class="line">ln -s /usr/<span class="built_in">local</span>/dnsmasq/sbin/dnsmasq /usr/sbin/</span><br><span class="line"><span class="comment"># 生成软连接</span></span><br><span class="line"></span><br><span class="line">dnsmasq --version</span><br><span class="line"><span class="comment"># 查看dnsmasq版本</span></span><br></pre></td></tr></table></figure>
<h1 id="配置-Dnsmasq"><a href="#配置-Dnsmasq" class="headerlink" title="配置 Dnsmasq"></a>配置 Dnsmasq</h1><p>Dnsmasq 处理 DNS 设置与 BIND 等其他 DNS 服务有所不同。所有的配置都在 <code>/etc/dnsmasq.conf</code> 这一个文件中完成 。官方在配置文件 <code>/etc/dnsmasq.conf</code> 中针对选项和参数等做了比较好的注释说明，我们可以将配置做一次备份，以便以后查阅。默认情况下 <code>dnsmasq.conf</code> 中只开启了最后 <code>include</code> 项，因此可以在 <code>/etc/dnsmasq.conf</code> 的前提下，将自定义的配置放到 <code>/etc/dnsmasq.d</code> 目录下的一个任意名字的配置文件当中。</p>
<p><strong>注意：</strong>   <code>/etc/dnsmasq.d/*.conf</code> 的优先级大于 <code>/etc/dnsmasq.conf</code> </p>
<h2 id="DNS-配置参数说明"><a href="#DNS-配置参数说明" class="headerlink" title="DNS 配置参数说明"></a>DNS 配置参数说明</h2><p>Dnsmasq配置文件是 <code>/etc/dnsmasq.conf</code>，下面对 Dnsmasq 常用的相关配置项进行说明。</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br><span class="line">71</span><br><span class="line">72</span><br><span class="line">73</span><br><span class="line">74</span><br><span class="line">75</span><br><span class="line">76</span><br><span class="line">77</span><br><span class="line">78</span><br><span class="line">79</span><br><span class="line">80</span><br><span class="line">81</span><br><span class="line">82</span><br><span class="line">83</span><br><span class="line">84</span><br><span class="line">85</span><br><span class="line">86</span><br><span class="line">87</span><br><span class="line">88</span><br><span class="line">89</span><br><span class="line">90</span><br><span class="line">91</span><br><span class="line">92</span><br><span class="line">93</span><br><span class="line">94</span><br><span class="line">95</span><br><span class="line">96</span><br><span class="line">97</span><br><span class="line">98</span><br><span class="line">99</span><br><span class="line">100</span><br><span class="line">101</span><br><span class="line">102</span><br><span class="line">103</span><br><span class="line">104</span><br><span class="line">105</span><br><span class="line">106</span><br><span class="line">107</span><br><span class="line">108</span><br><span class="line">109</span><br><span class="line">110</span><br><span class="line">111</span><br><span class="line">112</span><br><span class="line">113</span><br><span class="line">114</span><br><span class="line">115</span><br><span class="line">116</span><br><span class="line">117</span><br><span class="line">118</span><br><span class="line">119</span><br><span class="line">120</span><br><span class="line">121</span><br><span class="line">122</span><br><span class="line">123</span><br><span class="line">124</span><br><span class="line">125</span><br><span class="line">126</span><br><span class="line">127</span><br><span class="line">128</span><br><span class="line">129</span><br><span class="line">130</span><br><span class="line">131</span><br><span class="line">132</span><br><span class="line">133</span><br><span class="line">134</span><br><span class="line">135</span><br><span class="line">136</span><br><span class="line">137</span><br><span class="line">138</span><br></pre></td><td class="code"><pre><span class="line">Dnsmasq 默认启用其 DNS 服务器，并且会监听在 0.0.0.0:53，如果要用指定的端口代替 DNS 默认的 53 端口则配置如下选项，如果设置为0，则完全禁止 DNS 功能，只使用 dhcp 服务</span><br><span class="line"><span class="comment">#port=5353</span></span><br><span class="line"></span><br><span class="line">以下两个参数告诉 Dnsmasq 过滤一些查询：</span><br><span class="line">1.哪些公共DNS没有回答 </span><br><span class="line">2.哪些root根域不可达。</span><br><span class="line"></span><br><span class="line">从不转发格式错误的域名</span><br><span class="line"><span class="comment">#domain-needed</span></span><br><span class="line"></span><br><span class="line">从不转发不在路由地址中的域名</span><br><span class="line"><span class="comment">#bogus-priv</span></span><br><span class="line"></span><br><span class="line">Linux 处理 DNS 请求时有个限制，在 resolv.conf 中最多只能配置三个域名服务器（nameserver），我们完全可以使用 resolv-file 来作为变通方法，当然这只是其中的一个用途之一。这个参数表示 Dnsmasq 会从指定的文件中寻找上级 DNS 服务器列表，而不是从本机的 `resolv.conf` 中读取 DNS 服务器列表。如果机器的地址是通过 DHCP 方式取得的话，该文件( `resolv.conf` )容易受到影响从而影响到 Dnsmasq，因此配置此项避免影响</span><br><span class="line"></span><br><span class="line">resolv-file 配置 Dnsmasq 额外的上流的 DNS 服务器，如果不开启就使用linux主机默认的 /etc/resolv.conf 里的nameserver，如果开启则通过下面的选项指定其他文件。</span><br><span class="line"><span class="comment">#resolv-file=/etc/dnsmasq.d/upstream_dns.conf</span></span><br><span class="line"><span class="comment">#resolv-file=/etc/dnsmasq/resolv.conf</span></span><br><span class="line"></span><br><span class="line">默认情况下Dnsmasq会发送查询到它的任何上游DNS服务器上，如果取消注释，则Dnsmasq则会严格按照 /etc/resolv.conf 中的 DNS Server 顺序进行查询，直到第一个成功解析成功为止</span><br><span class="line"><span class="comment">#strict-order</span></span><br><span class="line"></span><br><span class="line">以下两个参数用来控制是否通过 /etc/resolv.conf 确定上游服务器，是否检测 /etc/resolv.conf 的变化，则取消注释。 </span><br><span class="line"></span><br><span class="line">如果你不想让Dnsmasq读取 /etc/resolv.conf 或者其他文件来获得它的servers，则取消注释</span><br><span class="line"><span class="comment">#no-resolv</span></span><br><span class="line"></span><br><span class="line">如果你不允许Dnsmasq通过轮询 /etc/resolv.conf 或者其他文件来改变和重新读取配置，则取消注释。 </span><br><span class="line"><span class="comment">#no-poll</span></span><br><span class="line"></span><br><span class="line">增加一个name server，一般用于内网域名</span><br><span class="line"><span class="comment">#server=/localnet/192.168.0.1</span></span><br><span class="line"></span><br><span class="line">设置一个反向解析，所有192.168.3.0/24的地址都到10.1.2.3去解析</span><br><span class="line"><span class="comment">#server=/3.168.192.in-addr.arpa/10.1.2.3</span></span><br><span class="line"></span><br><span class="line">增加一个本地域名，会在 /etc/hosts 或 DHCP 中进行查询</span><br><span class="line"><span class="comment">#local=/localnet/</span></span><br><span class="line"></span><br><span class="line">增加一个域名，使得这个域名强制解析到你指定的地址上</span><br><span class="line"><span class="comment">#address=/double-click.net/127.0.0.1</span></span><br><span class="line"></span><br><span class="line">同上，还支持ipv6</span><br><span class="line"><span class="comment">#address=/www.thekelleys.org.uk/fe80::20d:60ff:fe36:f83</span></span><br><span class="line"></span><br><span class="line">增加查询yahoo google的IP地址和它们的子域名到vpn、search查找</span><br><span class="line"><span class="comment">#ipset=/yahoo.com/google.com/vpn,search</span></span><br><span class="line"></span><br><span class="line">你还可以控制Dnsmasq和Server之间的查询从哪个网卡出去</span><br><span class="line">queries to 10.1.2.3 to be routed via eth1</span><br><span class="line"><span class="comment">#server=10.1.2.3@eth1</span></span><br><span class="line"></span><br><span class="line">设置了个源(本地)地址10.1.2.3，用来和192.168.1.1的55端口进行通信</span><br><span class="line">很显然，在机器上必须有一个与此IP相关联的接口</span><br><span class="line"><span class="comment">#server=10.1.2.3@192.168.1.1#55</span></span><br><span class="line"></span><br><span class="line">改变Dnsmasq默认的uid和gid</span><br><span class="line"><span class="comment">#user=</span></span><br><span class="line"><span class="comment">#group=</span></span><br><span class="line"></span><br><span class="line">如果你想让 Dnsmasq 监听在本机特定的网卡（包括回环网卡），用于 DHCP 和 DNS 请求，则设置此项</span><br><span class="line"><span class="comment">#interface=</span></span><br><span class="line"></span><br><span class="line">你还可以指定哪个网卡你不想监听</span><br><span class="line"><span class="comment">#except-interface=</span></span><br><span class="line"></span><br><span class="line">设置想监听的地址</span><br><span class="line"><span class="comment">#listen-address=</span></span><br><span class="line"></span><br><span class="line">要在单台主机上以守护进程方式启动 Dnsmasq 做 DNS (缓存)服务器，如果仅为本机使用则写上127.0.0.1。</span><br><span class="line"><span class="comment">#listen-address=127.0.0.1</span></span><br><span class="line">如果用此主机为局域网提供默认 DNS，请为该主机绑定固定 IP 地址，设置：</span><br><span class="line"><span class="comment">#listen-address=192.168.x.x</span></span><br><span class="line">这种情况建议配置静态IP。多个ip地址设置：</span><br><span class="line"><span class="comment">#listen-address=127.0.0.1,192.168.x.x </span></span><br><span class="line"></span><br><span class="line">如果你想让Dnsmasq在某个网卡上只提供dns服务，则可以进行配置禁止dhcp服务</span><br><span class="line"><span class="comment">#no-dhcp-interface=</span></span><br><span class="line"></span><br><span class="line">在支持 Dnsmasq 的系统上，Dnsmasq 绑定通配符地址，即使它只监听某些网卡。如果配置了此项，Dnsmasq 将丢弃它不应该回复的请求。即使在接口出现和更改地址时，这也具有工作的优势。如果您希望 Dnsmasq 只绑定它正在监听的接口，请取消注释</span><br><span class="line"><span class="comment">#bind-interfaces</span></span><br><span class="line"></span><br><span class="line">默认情况下这是注释掉的，Dnsmasq 会首先寻找本地的 /etc/hosts 文件，再去寻找缓存下来的域名</span><br><span class="line">如果你不想使用 /etc/hosts，则取消下面的注释</span><br><span class="line"><span class="comment">#no-hosts</span></span><br><span class="line"></span><br><span class="line">如果你想使用额外的类似/etc/hosts文件，则进行配置</span><br><span class="line"><span class="comment">#addn-hosts=/etc/banner_add_hosts</span></span><br><span class="line"></span><br><span class="line">如果你想让hosts中的一个域自动增加一个主机名，则配置此项。例如baidu.com，他将自动添加www</span><br><span class="line"><span class="comment">#expand-hosts</span></span><br><span class="line"></span><br><span class="line">为 Dnsmasq 设置一个域，简单地说就是给dhcp服务赋予一个域</span><br><span class="line">如果被设置，将会做以下事情</span><br><span class="line">1) 允许DHCP主机拥有完全合格的域名，只要域部分匹配这个设置</span><br><span class="line">2) 设置“域” 的 DHCP选项，从而设置由DHCP配置所有系统的域。</span><br><span class="line">3) 为 “expand-hosts” 提供 域 的部分</span><br><span class="line"><span class="comment">#domain=thekelleys.org.uk</span></span><br><span class="line"></span><br><span class="line">为特定子网设置不同的域</span><br><span class="line"><span class="comment">#domain=wireless.thekelleys.org.uk,192.168.2.0/24</span></span><br><span class="line"></span><br><span class="line">同上，不过子网是一个范围</span><br><span class="line"><span class="comment">#domain=reserved.thekelleys.org.uk,192.68.3.100,192.168.3.200</span></span><br><span class="line"></span><br><span class="line">dhcp分发ip的范围，以及每个ip的租约时间</span><br><span class="line"><span class="comment">#dhcp-range=192.168.0.50,192.168.0.150,12h</span></span><br><span class="line"></span><br><span class="line">同上，不过给出了掩码</span><br><span class="line"><span class="comment">#dhcp-range=192.168.0.50,192.168.0.150,255.255.255.0,12h</span></span><br><span class="line"></span><br><span class="line">为某个范围或子网设置标记，以便于某些设置只针对这些范围或子网生效</span><br><span class="line"><span class="comment">#dhcp-range=set:red,192.168.0.50,192.168.0.150</span></span><br><span class="line"><span class="comment">#dhcp-range=tag:green,192.168.0.50,192.168.0.150,12h</span></span><br><span class="line"></span><br><span class="line">自动加载conf-dir目录下的配置文件</span><br><span class="line"><span class="comment">#conf-dir=/etc/dnsmasq.d</span></span><br><span class="line">  </span><br><span class="line">设置dns缓存大小,默认为150条</span><br><span class="line"><span class="comment">#cache-size=8192</span></span><br><span class="line"></span><br><span class="line">是否禁用negative caching，取消注释意味着禁用。negative caching 允许 dnsmasq 记住从上游域名服务器上得到的“没有这样的域名”的查询结果，并对于相同的查询不再重复转发轮询上游服务器。简单的讲就是在没有禁用（未取消注释）的情况下，解析失败的域名不会再向上游服务器重复转发查询。</span><br><span class="line"><span class="comment">#no-negcache</span></span><br><span class="line"></span><br><span class="line">允许客户端缓存的时间，单位为秒</span><br><span class="line"><span class="comment">#local-ttl=60</span></span><br><span class="line"></span><br><span class="line">开启debug模式，记录客户端查询记录到/var/<span class="built_in">log</span>/debug中</span><br><span class="line"><span class="comment">#log-queries</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># Log lots of extra information about DHCP transactions.</span></span><br><span class="line"><span class="comment">#log-dhcp</span></span><br><span class="line"> </span><br><span class="line"><span class="comment"># Log to this syslog facility or file. (defaults to DAEMON)</span></span><br><span class="line"><span class="comment">#log-facility=/var/log/dnsmasq.log</span></span><br><span class="line"> </span><br><span class="line">异步<span class="built_in">log</span>，缓解阻塞。</span><br><span class="line"><span class="comment">#log-async=20</span></span><br></pre></td></tr></table></figure>
<h2 id="DNS配置实例"><a href="#DNS配置实例" class="headerlink" title="DNS配置实例"></a>DNS配置实例</h2><h3 id="基本配置"><a href="#基本配置" class="headerlink" title="基本配置"></a>基本配置</h3><p>下面的配置不是所有都是必须要配置的，根据实际应用情况而定。但是建议开启转发功能，以免配置 Dnsmasq 的转发相关的功能时造成排错困难</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># 允许本机的53端口可对外访问</span></span><br><span class="line">iptables -A INPUT -p udp -m udp --dport 53 -j ACCEPT</span><br><span class="line">iptables -A INPUT -p tcp -m tcp --dport 53 -j ACCEPT</span><br><span class="line"></span><br><span class="line"><span class="comment"># 转发DNS请求，开启流量转发功能，临时开启，重启后会失效，如需永久配置要编辑 /etc/sysctl.conf 开启</span></span><br><span class="line"><span class="built_in">echo</span> <span class="string">'1'</span> &gt; /proc/sys/net/ipv4/ip_forward</span><br><span class="line"><span class="built_in">echo</span> <span class="string">'1'</span> &gt; /proc/sys/net/ipv6/ip_forward   <span class="comment"># IPv6 用户选用</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># 添加流量转发规则，将外部到53的端口的请求映射到Dnsmasq服务器的53端口</span></span><br><span class="line">iptables -t nat -A PREROUTING -p udp --dport 53 -j REDIRECT --to-ports 53</span><br><span class="line">iptables -t nat -A PREROUTING -p tcp --dport 53 -j REDIRECT --to-ports 53</span><br></pre></td></tr></table></figure>
<h3 id="配置DNS（缓存）服务器"><a href="#配置DNS（缓存）服务器" class="headerlink" title="配置DNS（缓存）服务器"></a>配置DNS（缓存）服务器</h3><p>需要注意的是，一旦自定义的配置文件放到<code>/etc/dnsmasq.d/</code>中，配置文件中指定的某些文件就不能再放到这个目录里下了，因为会被 <code>/etc/dnsmasq.conf</code> 的 include 加载报错。因此我们创建一个目录 <code>/etc/dnsmasq-config/</code> 用来存放独有的hosts、resolv等文件</p>
<ul>
<li>创建一个自定义的配置文件 <code>/etc/dnsmasq.d/mydnsmasq.conf</code> ，并进行下列配置</li>
</ul>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line">no-poll</span><br><span class="line">strict-order</span><br><span class="line">no-negcache</span><br><span class="line">cache-size=8192</span><br><span class="line"><span class="built_in">local</span>-ttl=60</span><br><span class="line">no-hosts</span><br><span class="line">addn-hosts=/etc/dnsmasq-config/hosts</span><br><span class="line">resolv-file=/etc/dnsmasq-config/resolv.conf</span><br><span class="line">listen-address=192.168.127.130</span><br></pre></td></tr></table></figure>
<ul>
<li>hosts配置<code>/etc/dnsmasq-config/hosts</code></li>
</ul>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">10.94.0.67       us_zero01</span><br><span class="line">10.94.0.68       aws-nx</span><br><span class="line">10.94.0.69       awsire</span><br><span class="line">10.94.0.70       awsuk</span><br><span class="line">10.94.0.71       awsvirginia</span><br></pre></td></tr></table></figure>
<ul>
<li>resolv文件配置<code>/etc/dnsmasq-config/resolv.conf</code></li>
</ul>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">nameserver 8.8.8.8</span><br><span class="line">nameserver 9.9.9.9</span><br><span class="line">nameserver 114.114.114.114</span><br><span class="line">nameserver 180.96.96.96</span><br></pre></td></tr></table></figure>
<ul>
<li>测试</li>
</ul>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line">dnsmasq --<span class="built_in">test</span></span><br><span class="line"><span class="comment"># 语法检查</span></span><br><span class="line"></span><br><span class="line">systemctl daemon-reload</span><br><span class="line">systemctl restart dnsmasq</span><br><span class="line"><span class="comment"># 服务重启</span></span><br><span class="line"></span><br><span class="line">dig -p 53 @192.168.127.130 awsvirginia +short</span><br><span class="line"><span class="comment"># 正向解析</span></span><br><span class="line">dig -p 53 @192.168.127.130 -x  10.94.0.66</span><br><span class="line"><span class="comment"># 反向解析</span></span><br><span class="line"></span><br><span class="line"> dig -p 53 @192.168.127.130 www.baidu.com</span><br><span class="line"> dig -p 53 @192.168.127.130 www.baidu.com</span><br><span class="line"> 比较两次结果中的 Query time，缓存成功的情况下，第二次的查询时间明显大幅度降低</span><br></pre></td></tr></table></figure>
<h3 id="配置域名劫持"><a href="#配置域名劫持" class="headerlink" title="配置域名劫持"></a>配置域名劫持</h3><p>例如办公室明确规定不能访问360，我们可以将域名劫持，解析到一个不存在的内网地址。另外如果有自己独有的yum源服务器，还可以将相关域名劫持下来解析到自己的yum源服务器地址，从而达到加快速度、节省带宽的目的。</p>
<h4 id="使用hosts配置域名劫持"><a href="#使用hosts配置域名劫持" class="headerlink" title="使用hosts配置域名劫持"></a>使用hosts配置域名劫持</h4><p>可以使用系统自带的 <code>/etc/hosts</code>，也可以自定义hosts，针对某个域名做静态指向，缺点是无法支持泛域名，下面以自定义为例</p>
<ul>
<li>创建一个自定义的配置文件 <code>/etc/dnsmasq.d/mydnsmasq.conf</code> ，并进行下列配置</li>
</ul>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line">no-poll</span><br><span class="line">strict-order</span><br><span class="line">no-negcache</span><br><span class="line">cache-size=8192</span><br><span class="line"><span class="built_in">local</span>-ttl=60</span><br><span class="line">no-hosts</span><br><span class="line">addn-hosts=/etc/dnsmasq-config/hosts</span><br><span class="line">listen-address=192.168.127.130</span><br></pre></td></tr></table></figure>
<ul>
<li>添加hosts</li>
</ul>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="built_in">echo</span> <span class="string">'10.10.10.10 www.360.cn'</span> &gt;&gt; /etc/dnsmasq-config/hosts</span><br></pre></td></tr></table></figure>
<ul>
<li>测试</li>
</ul>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line">dnsmasq --<span class="built_in">test</span></span><br><span class="line"><span class="comment"># 语法检查</span></span><br><span class="line"></span><br><span class="line">systemctl daemon-reload</span><br><span class="line">systemctl restart dnsmasq</span><br><span class="line"><span class="comment"># 服务重启</span></span><br><span class="line"></span><br><span class="line">dig -p 53 @192.168.127.130 www.360.cn</span><br><span class="line">dig -p 53 @192.168.127.130 sd.360.cn</span><br><span class="line"><span class="comment"># 经过测试可以发现，指定的域名被拦截，同一个域下其他的无法被拦截</span></span><br></pre></td></tr></table></figure>
<h4 id="使用address配置域名劫持"><a href="#使用address配置域名劫持" class="headerlink" title="使用address配置域名劫持"></a>使用address配置域名劫持</h4><p>address可以将指定的域解析为一个IP地址，即泛域名解析。</p>
<p><strong>注意：</strong> 如果针对同样的域名同时配置了no-hosts、addn-hosts、address，那么 <code>/etc/hosts</code> 优先级最高，addn-hosts的优先级次之，address优先级最低，前提是no-hosts参数必须在 address 与 addn-hosts 之前才可以。</p>
<ul>
<li>创建一个自定义的配置文件 <code>/etc/dnsmasq.d/mydnsmasq.conf</code> ，并进行下列配置</li>
</ul>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line">no-poll</span><br><span class="line">strict-order</span><br><span class="line">no-negcache</span><br><span class="line">cache-size=8192</span><br><span class="line"><span class="built_in">local</span>-ttl=60</span><br><span class="line">no-hosts</span><br><span class="line">address=/360.cn/10.10.10.10</span><br><span class="line">listen-address=192.168.127.130</span><br></pre></td></tr></table></figure>
<ul>
<li>测试</li>
</ul>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line">dnsmasq --<span class="built_in">test</span></span><br><span class="line"><span class="comment"># 语法检查</span></span><br><span class="line"></span><br><span class="line">systemctl daemon-reload</span><br><span class="line">systemctl restart dnsmasq</span><br><span class="line"><span class="comment"># 服务重启</span></span><br><span class="line"></span><br><span class="line">dig -p 53 @192.168.127.130 www.360.cn</span><br><span class="line">dig -p 53 @192.168.127.130 sd.360.cn</span><br><span class="line">dig -p 53 @192.168.127.130 www.baidu.com</span><br></pre></td></tr></table></figure>
<h3 id="生产环境中的DNS拦截使用"><a href="#生产环境中的DNS拦截使用" class="headerlink" title="生产环境中的DNS拦截使用"></a>生产环境中的DNS拦截使用</h3><ul>
<li>在cdn网络加速的生产环境中，通常使用了类似于Nginx这样的反向代理手段，通过加速网络向源站服务器获取资源。</li>
<li>假设我们想要使用curl命令做资源下载测试，并需要使用普通网络和加速网络做下载速度对比。</li>
<li>环境说明：<ul>
<li>服务器A：做下载测试的服务器</li>
<li>源站URL：<code>https://s3-ap-southeast-1.amazonaws.com/download-speed-sg-test/20M.tar</code></li>
<li>代理服务器：Nginx服务器为192.168.123.45，加速网络环境的服务器</li>
</ul>
</li>
</ul>
<p>实现手段：</p>
<blockquote>
<p>普通网络环境的下载。直接在服务器A进行下载即可</p>
</blockquote>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">/usr/<span class="built_in">local</span>/bin/curl -4 -o /dev/nul https://s3-ap-southeast-1.amazonaws.com/download-speed-sg-test/20M.tar</span><br></pre></td></tr></table></figure>
<blockquote>
<p>加速网络环境的下载。</p>
</blockquote>
<p>1、在服务器A启用dnsmasq，将URL对应的域名拦截，使用自定义hosts的方式指向Nginx服务器</p>
<p><code>/etc/dnsmasq.d/nginx-test.conf</code></p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line">no-poll</span><br><span class="line">strict-order</span><br><span class="line">no-negcache</span><br><span class="line">cache-size=8192</span><br><span class="line"><span class="built_in">local</span>-ttl=60</span><br><span class="line">addn-hosts=/opt/<span class="built_in">test</span>/dns_host.conf</span><br></pre></td></tr></table></figure>
<p><code>/opt/test/dns_host.conf</code></p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">193.192.168.123.45 s3-ap-southeast-1.amazonaws.com</span><br></pre></td></tr></table></figure>
<p>2、下载测试<br>使用新版本的curl选项中的<code>--dns-servers</code>选项指定dns进行下载</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">/usr/<span class="built_in">local</span>/bin/curl -4 -o /dev/null --dns-servers 127.0.0.1 https://s3-ap-southeast-1.amazonaws.com/download-speed-sg-test/20M.tar</span><br><span class="line"></span><br><span class="line"><span class="comment"># 系统自带的curl命令不支持--dns-servers，因此如果有这样的需求就要编译新版本的curl来支持dns</span></span><br></pre></td></tr></table></figure>
<p>由此以来，服务器A的资源下载请求被dnsmasq转向了Nginx服务器，从而进入加速网络获取资源</p>
<h3 id="泛域名配置应用"><a href="#泛域名配置应用" class="headerlink" title="泛域名配置应用"></a>泛域名配置应用</h3><p>在很多情况下，我们可能只需要访问某个域中其中一个域名，而其他域名不期望访问，这个需求可通过如下方式配置实现：</p>
<ul>
<li>创建一个自定义的配置文件 <code>/etc/dnsmasq.d/mydnsmasq.conf</code> ，并进行下列配置</li>
</ul>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line">no-poll</span><br><span class="line">strict-order</span><br><span class="line">no-negcache</span><br><span class="line">cache-size=8192</span><br><span class="line"><span class="built_in">local</span>-ttl=60</span><br><span class="line">no-hosts</span><br><span class="line">address=/google.com/10.10.10.10</span><br><span class="line">server=/maps.google.com/mail.google.com/<span class="comment">#</span></span><br><span class="line"><span class="comment"># 如果使用 # 代替dns地址，则使用标准 DNS 服务器，即 Dnsmasq 默认使用的 /etc/resolv.conf 的 nameserver 指定的服务器地址</span></span><br><span class="line">listen-address=192.168.127.130</span><br></pre></td></tr></table></figure>
<ul>
<li>测试</li>
</ul>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><span class="line">dnsmasq --<span class="built_in">test</span></span><br><span class="line"><span class="comment"># 语法检查</span></span><br><span class="line"></span><br><span class="line">systemctl daemon-reload</span><br><span class="line">systemctl restart dnsmasq</span><br><span class="line"><span class="comment"># 服务重启</span></span><br><span class="line"></span><br><span class="line">dig -p 53 @192.168.127.130 www.google.com</span><br><span class="line">dig -p 53 @192.168.127.130 test.google.com</span><br><span class="line">dig -p 53 @192.168.127.130 mail.google.com</span><br><span class="line">dig -p 53 @192.168.127.130 maps.google.com</span><br></pre></td></tr></table></figure>
<ul>
<li>另外一种情况是实现泛域名做代理，某个或某些子域名不做代理，例如下面的配置，就实现了 <code>nordstrom.com</code> 整个域的数据拦截下来转发到代理服务器 192.168.127.100 ，而 <code>m.nordstrom.com</code> 和 <code>mail.nordstrom.com</code> 不做代理</li>
</ul>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">address=/nordstrom.com/192.168.127.100</span><br><span class="line">server=/m.nordstrom.com/mail.nordstrom.com/<span class="comment">#</span></span><br></pre></td></tr></table></figure>
<ul>
<li>把所有.cn的域名全部通过114.114.114.114这台国内DNS服务器来解析</li>
</ul>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">server=/cn/114.114.114.114</span><br></pre></td></tr></table></figure>
<ul>
<li>给<code>*.apple.com</code> 和 <code>taobao.com</code> 使用专用的DNS</li>
</ul>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">server=/taobao.com/223.5.5.5</span><br><span class="line">server=/.apple.com/223.5.5.5</span><br></pre></td></tr></table></figure>
<ul>
<li>把www.360.cn解析到特定的IP</li>
</ul>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">address=/www.360.cn/10.10.10.10</span><br></pre></td></tr></table></figure>
<h3 id="选择最快的上游DNS服务器"><a href="#选择最快的上游DNS服务器" class="headerlink" title="选择最快的上游DNS服务器"></a>选择最快的上游DNS服务器</h3><p>经常会有这样的情景， Dnsmasq 服务器配了一堆上游服务器，转发本地的dns请求，缺省是 Dnsmasq 事实上是只挑了一个上游dns服务器来查询并转发结果，这样如果选错服务器的话会导致DNS响应变慢。</p>
<ul>
<li>创建一个自定义的配置文件 <code>/etc/dnsmasq.d/mydnsmasq.conf</code>，并进行下列配置</li>
</ul>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">all-servers</span><br><span class="line"><span class="comment"># all-servers表示对以下设置的所有server发起查询，选择回应最快的一条作为查询结果返回</span></span><br><span class="line">server=8.8.8.8</span><br><span class="line">server=9.9.9.9</span><br><span class="line">server=219.141.136.10</span><br></pre></td></tr></table></figure>
<h3 id="Dnsmasq-性能优化"><a href="#Dnsmasq-性能优化" class="headerlink" title="Dnsmasq 性能优化"></a>Dnsmasq 性能优化</h3><p>Bind不配合数据库的情况下，经常需要重新载入并读取配置文件，这是造成性能低下的原因。根据这点教训，我们可以考虑不读取 <code>/etc/hosts</code> 文件。而是另外指定一个在共享内存里的文件，比如 <code>/dev/shm/dnsrecord.txt</code> ，这样就不费劲了，又由于内存的非持久性，重启就消失，可以定期同步硬盘上的某个内容到内存文件中。</p>
<ul>
<li>创建一个自定义的配置文件 <code>/etc/dnsmasq.d/mydnsmasq.conf</code>，并进行下列配置</li>
</ul>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">no-hosts </span><br><span class="line">addn-hosts=/dev/shm/dnsrecord.txt</span><br></pre></td></tr></table></figure>
<ul>
<li>解决同步问题</li>
</ul>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">chmod +x /etc/rc.local </span><br><span class="line"><span class="built_in">echo</span> <span class="string">"cat /etc/hosts &gt; /dev/shm/dnsrecord.txt"</span> &gt;&gt; /etc/rc.local </span><br><span class="line"><span class="comment"># 开机启动</span></span><br></pre></td></tr></table></figure>
<ul>
<li>使用计划任务定时同步内容</li>
</ul>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">*/10 * * * * cat /etc/hosts &gt; /dev/shm/dnsrecord.txt</span><br></pre></td></tr></table></figure>
<h2 id="DHCP配置参数说明"><a href="#DHCP配置参数说明" class="headerlink" title="DHCP配置参数说明"></a>DHCP配置参数说明</h2><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># 选定需要监听的网卡</span></span><br><span class="line"><span class="comment"># Only listen to routers' LAN NIC.  Doing so opens up tcp/udp port 53 to</span></span><br><span class="line"><span class="comment"># localhost and udp port 67 to world:</span></span><br><span class="line">interface=&lt;LAN-NIC&gt;</span><br><span class="line"></span><br><span class="line"><span class="comment"># dnsmasq will open tcp/udp port 53 and udp port 67 to world to help with</span></span><br><span class="line"><span class="comment"># dynamic interfaces (assigning dynamic ips). Dnsmasq will discard world</span></span><br><span class="line"><span class="comment"># requests to them, but the paranoid might like to close them and let the </span></span><br><span class="line"><span class="comment"># kernel handle them:</span></span><br><span class="line"><span class="built_in">bind</span>-interfaces</span><br><span class="line"></span><br><span class="line">设定可分配的ip地址段和租约时间</span><br><span class="line"><span class="comment"># Dynamic range of IPs to make available to LAN pc</span></span><br><span class="line">dhcp-range=192.168.111.50,192.168.111.150,12h</span><br><span class="line"><span class="comment"># 同上，不过给出了掩码</span></span><br><span class="line"><span class="comment">#dhcp-range=192.168.8.50,192.168.8.150,255.255.255.0,12h</span></span><br><span class="line"></span><br><span class="line"><span class="comment">#绑定某些机器的ip-mac地址对，使其具有固定的ip地址</span></span><br><span class="line"><span class="comment"># If you’d like to have dnsmasq assign static IPs, bind the LAN computer's</span></span><br><span class="line"><span class="comment"># NIC MAC address:</span></span><br><span class="line">dhcp-host=aa:bb:cc:dd:ee:ff,192.168.1.50</span><br><span class="line">dhcp-host=00:0e:7b:ca:1c:6e,daunbook,192.168.0.12</span><br><span class="line"><span class="comment"># 为192.168.0.12设置主机名：dannbook</span></span><br><span class="line"><span class="comment"># dhcp服务的静态绑定</span></span><br><span class="line"><span class="comment"># dhcp-host=08:00:27:D1:CF:E2,192.168.8.201,infinite 无限租期</span></span><br><span class="line">dhcp-host=08:00:27:D1:CF:E2,192.168.8.201,db2</span><br><span class="line">dhcp-host=08:00:27:D6:F0:9F,192.168.8.202,db3</span><br><span class="line"></span><br><span class="line"><span class="comment"># 注意:当为某一MAC地址同时静态分配主机名和IP时，如果写到两条dhcp-host选项里（如下所示），则只会生效后面的一条。正确的选项写法如上配置。</span></span><br><span class="line">dhcp-host=08:00:27:D1:CF:E2,192.168.8.201 dhcp-host=08:00:27:D1:CF:E2,db2</span><br><span class="line">dhcp-host=08:00:27:D1:CF:E2,192.168.8.201</span><br><span class="line">dhcp-host=08:00:27:D1:CF:E2,db2</span><br><span class="line"></span><br><span class="line"><span class="comment"># 重新启动客户端网卡。由于之前测试中客户端网卡已经申请了DHCP租期。所以这里需要修改租期文件，让客户端重新获得IP和hostname。</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># 设置默认租期</span></span><br><span class="line"><span class="comment"># Set the limit on DHCP leases, the default is 150</span></span><br><span class="line"><span class="comment">#dhcp-lease-max=150</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># 租期保存文件</span></span><br><span class="line"><span class="comment">#dhcp-leasefile=/var/lib/dnsmasq/dnsmasq.leases</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># 通过/etc/hosts来分配对应的hostname</span></span><br><span class="line"><span class="comment">#dhcp-host=judge</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># 忽略下面MAC地址的DHCP请求</span></span><br><span class="line"><span class="comment">#dhcp-host=11:22:33:44:55:66,ignore</span></span><br><span class="line"> </span><br><span class="line"><span class="comment"># dhcp所在的domain</span></span><br><span class="line">domain=freeoa.net</span><br><span class="line"> </span><br><span class="line"><span class="comment"># 设置默认路由出口</span></span><br><span class="line"><span class="comment"># dhcp-option遵循RFC 2132（Options and BOOTP Vendor Extensions),可以通过dnsmasq --help dhcp来查看具体的配置</span></span><br><span class="line"><span class="comment"># 很多高级的配置，如iSCSI连接配置等同样可以由RFC 2132定义的dhcp-option中给出。</span></span><br><span class="line"><span class="comment"># option 3为default route</span></span><br><span class="line">dhcp-option=3,192.168.8.1</span><br><span class="line"></span><br><span class="line"><span class="comment"># 设置NTP Server.这是使用option name而非选项名来进行设置</span></span><br><span class="line"><span class="comment">#dhcp-option=option:ntp-server,192.168.8.4,10.10.0.5</span></span><br><span class="line"></span><br><span class="line">               </span><br><span class="line"><span class="comment">#当dnsmasq绝对是网络上唯一的DHCP服务器时应该设置。对于DHCPv4，它将从严格的RFC合规性中更改行为，以便不会忽略来自未知主机的未知租约的DHCP请求。这使得新主机在任何情况下都可以获得租约，而不会出现繁琐的超时。如果数据库丢失，它也允许dnsmasq重建其租赁数据库，而不需要每个客户端重新获得租约。对于DHCPv6，它将响应中的优先级设置为255（最大值），而不是0（最小值）。</span></span><br><span class="line">dhcp-authoritative</span><br></pre></td></tr></table></figure>
<h2 id="DHCP配置实例"><a href="#DHCP配置实例" class="headerlink" title="DHCP配置实例"></a>DHCP配置实例</h2><p>公司使用了三台Linux服务器作为网关为局域网中的其他设备提供IP和路由，以下是其中一个范例 <code>dhcp.conf</code></p>
<ul>
<li>Dnsmasq的全局配置</li>
</ul>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br></pre></td><td class="code"><pre><span class="line"></span><br><span class="line"><span class="comment"># global settings</span></span><br><span class="line">no-hosts</span><br><span class="line">strict-order</span><br><span class="line">no-negcache</span><br><span class="line">cache-size=8192</span><br><span class="line">interface=br0</span><br><span class="line">no-dhcp-interface=eth0</span><br><span class="line">dhcp-authoritative</span><br><span class="line"></span><br><span class="line"><span class="comment"># start,end,netmask,lease</span></span><br><span class="line">dhcp-range=172.20.35.10,172.20.35.200,255.255.252.0,18h</span><br><span class="line"><span class="comment"># 为宾客或测试机指定特定的地址范围、掩码、续订期</span></span><br><span class="line">dhcp-range=net:gw7,172.20.32.10,172.20.32.200,255.255.252.0,18h</span><br><span class="line">dhcp-range=net:gw5,172.20.33.10,172.20.33.200,255.255.252.0,18h</span><br><span class="line"><span class="comment"># 使用了两个标记 net:gw5 和 net:gw7 来标识其他两个设备，并分别指定了特定的地址范围、掩码、续订期</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># 默认路由（网关）</span></span><br><span class="line">dhcp-option=3,172.20.32.5</span><br><span class="line"><span class="comment"># 默认的DNS</span></span><br><span class="line">dhcp-option=6,172.20.32.5</span><br><span class="line"></span><br><span class="line"><span class="comment"># 为标记是 net:gw5 的范围指定默认路由</span></span><br><span class="line">dhcp-option=net:gw5,3,172.20.32.5</span><br><span class="line"><span class="comment"># 为标记是 net:gw5 的范围指定默认DNS</span></span><br><span class="line">dhcp-option=net:gw5,6,172.20.32.5</span><br><span class="line"></span><br><span class="line"><span class="comment"># 为标记是 net:gw7 的范围指定默认路由</span></span><br><span class="line">dhcp-option=net:gw7,3,172.20.32.7</span><br><span class="line"><span class="comment"># 为标记是 net:gw7 的范围指定默认DNS</span></span><br><span class="line">dhcp-option=net:gw7,6,172.20.32.7</span><br><span class="line"></span><br><span class="line"><span class="comment"># domain name</span></span><br><span class="line">dhcp-option=15,dhcp.netfits.com</span><br><span class="line"><span class="comment"># broadcast</span></span><br><span class="line">dhcp-option=28,172.20.35.255</span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="comment"># 为特定的MAC地址绑定特定的IP</span></span><br><span class="line">dhcp-host=2C:60:0C:1C:BE:7A,litingjie1,172.20.33.88,18h,net:gw5</span><br><span class="line">dhcp-host=D0:7E:35:C7:F3:67,litingjie2,172.20.33.89,18h,net:gw5</span><br><span class="line">dhcp-host=AC:C1:EE:30:BF:82,litingjie3,172.20.33.90,18h,net:gw5</span><br></pre></td></tr></table></figure>
<h1 id="web端的配置"><a href="#web端的配置" class="headerlink" title="web端的配置"></a>web端的配置</h1><p>Dnsmasq的WEB端：<a href="https://github.com/luxiaok/DNSmasqWeb" target="_blank" rel="noopener">https://github.com/luxiaok/DNSmasqWeb</a></p>
<h2 id="dnsmasq命令选项说明"><a href="#dnsmasq命令选项说明" class="headerlink" title="dnsmasq命令选项说明"></a>dnsmasq命令选项说明</h2><p><strong>提示：</strong> 查看配置文件语法是否正确，可执行下列命令：</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">dnsmasq --<span class="built_in">test</span></span><br></pre></td></tr></table></figure>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br></pre></td><td class="code"><pre><span class="line">--<span class="built_in">test</span> </span><br><span class="line">	检查配置文件语法</span><br><span class="line"></span><br><span class="line">-T, --<span class="built_in">local</span>-ttl=&lt;time&gt;</span><br><span class="line">    当与从/etc/ hosts或在DHCP租约文件，默认设置的dnsmasq信息返回到本机ttl值为零，这意味着请求者不应本身缓存信息。此选项允许设定dhcp请求数据包的生存时间。这将减少在某些情况下过时的请求数据给客户端服务器造成的负载。</span><br><span class="line"></span><br><span class="line">-x, --pid-file=&lt;path&gt;</span><br><span class="line">    指定一个备用的路径来记录进程ID通常保存的目录为/var/dnsmasq.pid。</span><br><span class="line"></span><br><span class="line">-v, --version</span><br><span class="line">    打印版本号。</span><br><span class="line"></span><br><span class="line">-p, --port=&lt;port&gt;</span><br><span class="line">    指定DNS的端口代替标准的DNS端口（53）。设置此为零完全禁用DNS功能，只留下DHCP和/或TFTP。</span><br><span class="line">-P,--edns-packet-max=&lt;size&gt;</span><br><span class="line">    指定DNS转发支持的最大数据包大小。 默认是1280，这是以太网RFC2671建议的最大值。</span><br><span class="line"></span><br><span class="line">-i, --interface=&lt;interface name&gt;</span><br><span class="line">    只监听指定的接口。当此命令指定的接口被使用时，dnsmasq会自动添加本地接口到接口列表。</span><br><span class="line"></span><br><span class="line">-I, --except-interface=&lt;interface name&gt;</span><br><span class="line">   指定不监听的接口。</span><br><span class="line"></span><br><span class="line">-2, --no-dhcp-interface=&lt;interface name&gt;</span><br><span class="line">    不提供DHCP或TFTP在指定的接口，但提供DNS服务。</span><br><span class="line">-a,--listen-address=&lt;ipaddr&gt;</span><br><span class="line">    侦听指定的IP地址。监听的接口和IP地址可同时指定。如果指定监听的IP地址而指定未监听接口的，dnsmasq不会自动监听去回环节口（loopback）。所以如果配置此选项一般要明确的给出监听地址的为127.0.0.1</span><br><span class="line"></span><br><span class="line">-r, --resolv-file=&lt;file&gt;</span><br><span class="line">    读取文件上的域名服务器的IP地址，dnsmasq可轮询多个resolv.conf文件的域名服务器。</span><br><span class="line"></span><br><span class="line">-R, --no-resolv</span><br><span class="line">    不要读取/ etc / resolv.conf中。只得到命令行或配置文件中的dnsmasq上游域名服务器。</span><br><span class="line"></span><br><span class="line">-c, --cache-size=&lt;cachesize&gt;</span><br><span class="line">    设置的dnsmasq的缓存大小。默认为150条。设置缓存大小为零禁用缓存。</span><br><span class="line"></span><br><span class="line">-N, --no-negcache</span><br><span class="line">    禁用否定缓存。否定缓存允许dnsmasq记住从上游域名服务器上得到的“没有这样的域名”的查询结果，并对于相同的查询不再重复转发轮询上游服务器。</span><br><span class="line"></span><br><span class="line">-0, --dns-forward-max=&lt;queries&gt;</span><br><span class="line">    设置DNS的查询并发的最大数量。默认值是150。</span><br><span class="line"></span><br><span class="line">-F,--dhcp-range=[[net:]network-id,]&lt;start-addr&gt;,&lt;end-addr&gt;[[,&lt;netmask&gt;],&lt;broadcast&gt;][,&lt;defaultlease time&gt;]</span><br><span class="line">    启用DHCP服务器。地址将会给出了从范围&lt;start-addr&gt;到&lt;end-addr&gt;和静态定义的地址在DHCP主机选项给出。如果租用时间给出，然后租赁将会给予该时间长度。租用时间以秒或分钟（如4500）或时间（如1小时）或无限期“infinite”。最低租赁时间为两分钟。广播地址始终是可选的。</span><br><span class="line">-u,--user=&lt;username&gt;</span><br><span class="line">指定用户ID，开始的dnsmasq通常必须为root身份。</span><br><span class="line"></span><br><span class="line">-k, --keep-in-foreground </span><br><span class="line">不在后台进行fork，不运行debug模式</span><br><span class="line"></span><br><span class="line">-K, --dhcp-authoritative</span><br><span class="line">当一个网络上只有确定的一台DHCP服务器时，此参数应该被设置成dhcp-authoritative。这样可以确保从未知主机发送的未知租约不会被忽略。这样就使得新的主机在任何情况下及时的得到租约请求相应。还有一个重要作用是，当服务器的租赁数据库丢失了，此参数可以允许dnsmasq重建租约数据库，而不用与每个客户主机逐一重新请求租约。</span><br><span class="line"></span><br><span class="line">-X, --dhcp-lease-max=&lt;number&gt;</span><br><span class="line">    限制的dnsmasq到DHCP租约规定的最大数目。默认为150。此限制是为了防止非法主机从服务器租赁大量的ip地址造成内存大量占用，从而形成DoS攻击。</span><br><span class="line"></span><br><span class="line">--<span class="built_in">log</span>-dhcp</span><br><span class="line">    额外的DHCP日志记录：记录所有的选项发送到DHCP客户端和用于确定他们的NetID标签。</span><br><span class="line"></span><br><span class="line">-l, --dhcp-leasefile=&lt;path&gt;</span><br><span class="line">    使用指定的文件存储DHCP的租赁信息。存储的信息包括客户端的MAC地址，ip地址，计算机名等。</span><br><span class="line"></span><br><span class="line">-C, --conf-file=&lt;file&gt;</span><br><span class="line">指定一个不同的配置文件。此配置文件选项也允许在配置文件中使用，以包含多个配置文件。</span><br></pre></td></tr></table></figure>
<h1 id="参考链接"><a href="#参考链接" class="headerlink" title="参考链接"></a>参考链接</h1><ul>
<li><a href="http://www.thekelleys.org.uk/dnsmasq/docs/dnsmasq-man.html" target="_blank" rel="noopener">http://www.thekelleys.org.uk/dnsmasq/docs/dnsmasq-man.html</a></li>
<li><a href="http://www.freeoa.net/osuport/servap/dnsmasq-use-intro-refer_2480.html" target="_blank" rel="noopener">http://www.freeoa.net/osuport/servap/dnsmasq-use-intro-refer_2480.html</a></li>
<li><a href="https://wiki.archlinux.org/index.php/Dnsmasq_%28%E7%AE%80%E4%BD%93%E4%B8%AD%E6%96%87%29" target="_blank" rel="noopener">https://wiki.archlinux.org/index.php/Dnsmasq_%28%E7%AE%80%E4%BD%93%E4%B8%AD%E6%96%87%29</a></li>
<li><a href="http://www.yunweipai.com/archives/8664.html" target="_blank" rel="noopener">http://www.yunweipai.com/archives/8664.html</a></li>
</ul>

      
    </div>
    
    
    

    

    
      <div>
        <div style="padding: 10px 0; margin: 20px auto; width: 90%; text-align: center;">
  <div>有钱任性，请我吃包辣条</div>
  <button id="rewardButton" disable="enable" onclick="var qr = document.getElementById('QR'); if (qr.style.display === 'none') {qr.style.display='block';} else {qr.style.display='none'}">
    <span>打赏</span>
  </button>
  <div id="QR" style="display: none;">

    
      <div id="wechat" style="display: inline-block">
        <img id="wechat_qr" src="/images/wechatpay.jpg" alt="孟庆宇 微信支付"/>
        <p>微信支付</p>
      </div>
    

    
      <div id="alipay" style="display: inline-block">
        <img id="alipay_qr" src="/images/alipay.jpg" alt="孟庆宇 支付宝"/>
        <p>支付宝</p>
      </div>
    

    

  </div>
</div>

      </div>
    

    
      <div>
        <ul class="post-copyright">
  <li class="post-copyright-author">
    <strong>本文作者：</strong>
    孟庆宇
  </li>
  <li class="post-copyright-link">
    <strong>本文链接：</strong>
    <a href="http://linuxgeeks.github.io/2018/01/16/2018-01-16-161310-利用Dnsmasq搭建本地自有DNS服务器/" title="利用Dnsmasq搭建本地自有DNS服务器">http://linuxgeeks.github.io/2018/01/16/2018-01-16-161310-利用Dnsmasq搭建本地自有DNS服务器/</a>
  </li>
  <li class="post-copyright-license">
    <strong>版权声明： </strong>
    本博客所有文章除特别声明外，均采用 <a href="https://creativecommons.org/licenses/by-nc-sa/3.0/" rel="external nofollow" target="_blank">CC BY-NC-SA 3.0</a> 许可协议。转载请注明出处！
  </li>
</ul>

      </div>
    

    <footer class="post-footer">
      
        <div class="post-tags">
          
            <a href="/tags/DNS/" rel="tag"><i class="fa fa-tag"></i> DNS</a>
          
            <a href="/tags/DHCP/" rel="tag"><i class="fa fa-tag"></i> DHCP</a>
          
        </div>
      

      
      
      

      
        <div class="post-nav">
          <div class="post-nav-next post-nav-item">
            
              <a href="/2018/01/15/2018-01-15-200310-NegativeCaching的简单理解/" rel="next" title="NegativeCaching的简单理解">
                <i class="fa fa-chevron-left"></i> NegativeCaching的简单理解
              </a>
            
          </div>

          <span class="post-nav-divider"></span>

          <div class="post-nav-prev post-nav-item">
            
              <a href="/2018/01/19/2018-01-19-214844-curl-7-57-0源码包编译安装和移植/" rel="prev" title="curl-7.57.0源码包编译安装和移植">
                curl-7.57.0源码包编译安装和移植 <i class="fa fa-chevron-right"></i>
              </a>
            
          </div>
        </div>
      

      
      
    </footer>
  </div>
  
  
  
  </article>



    <div class="post-spread">
      
        
  <div class="bdsharebuttonbox">
    <a href="#" class="bds_tsina" data-cmd="tsina" title="分享到新浪微博"></a>
    <a href="#" class="bds_douban" data-cmd="douban" title="分享到豆瓣网"></a>
    <a href="#" class="bds_sqq" data-cmd="sqq" title="分享到QQ好友"></a>
    <a href="#" class="bds_qzone" data-cmd="qzone" title="分享到QQ空间"></a>
    <a href="#" class="bds_weixin" data-cmd="weixin" title="分享到微信"></a>
    <a href="#" class="bds_tieba" data-cmd="tieba" title="分享到百度贴吧"></a>
    <a href="#" class="bds_twi" data-cmd="twi" title="分享到Twitter"></a>
    <a href="#" class="bds_fbook" data-cmd="fbook" title="分享到Facebook"></a>
    <a href="#" class="bds_more" data-cmd="more"></a>
    <a class="bds_count" data-cmd="count"></a>
  </div>
  <script>
    window._bd_share_config = {
      "common": {
        "bdText": "",
        "bdMini": "2",
        "bdMiniList": false,
        "bdPic": ""
      },
      "share": {
        "bdSize": "16",
        "bdStyle": "0"
      },
      "image": {
        "viewList": ["tsina", "douban", "sqq", "qzone", "weixin", "twi", "fbook"],
        "viewText": "分享到：",
        "viewSize": "16"
      }
    }
  </script>

<script>
  with(document)0[(getElementsByTagName('head')[0]||body).appendChild(createElement('script')).src='//bdimg.share.baidu.com/static/api/js/share.js?cdnversion='+~(-new Date()/36e5)];
</script>

      
    </div>
  </div>


          </div>
          


          
  


        </div>
        
          
  
  <div class="sidebar-toggle">
    <div class="sidebar-toggle-line-wrap">
      <span class="sidebar-toggle-line sidebar-toggle-line-first"></span>
      <span class="sidebar-toggle-line sidebar-toggle-line-middle"></span>
      <span class="sidebar-toggle-line sidebar-toggle-line-last"></span>
    </div>
  </div>

  <aside id="sidebar" class="sidebar">
    
      <div id="sidebar-dimmer"></div>
    
    <div class="sidebar-inner">

      

      
        <ul class="sidebar-nav motion-element">
          <li class="sidebar-nav-toc sidebar-nav-active" data-target="post-toc-wrap">
            文章目录
          </li>
          <li class="sidebar-nav-overview" data-target="site-overview-wrap">
            站点概览
          </li>
        </ul>
      

      <section class="site-overview-wrap sidebar-panel">
        <div class="site-overview">
          <div class="site-author motion-element" itemprop="author" itemscope itemtype="http://schema.org/Person">
            
              <img class="site-author-image" itemprop="image"
                src="/images/avatar.jpg"
                alt="孟庆宇" />
            
              <p class="site-author-name" itemprop="name">孟庆宇</p>
              <p class="site-description motion-element" itemprop="description">书山有路勤为径，学海无涯苦作舟</p>
          </div>

          <nav class="site-state motion-element">

            
              <div class="site-state-item site-state-posts">
              
                <a href="/archives/">
              
                  <span class="site-state-item-count">109</span>
                  <span class="site-state-item-name">日志</span>
                </a>
              </div>
            

            
              
              
              <div class="site-state-item site-state-categories">
                <a href="/categories/index.html">
                  <span class="site-state-item-count">23</span>
                  <span class="site-state-item-name">分类</span>
                </a>
              </div>
            

            
              
              
              <div class="site-state-item site-state-tags">
                <a href="/tags/index.html">
                  <span class="site-state-item-count">56</span>
                  <span class="site-state-item-name">标签</span>
                </a>
              </div>
            

          </nav>

          
            <div class="feed-link motion-element">
              <a href="/atom.xml" rel="alternate">
                <i class="fa fa-rss"></i>
                RSS
              </a>
            </div>
          

          <div class="links-of-author motion-element">
            
              
                <span class="links-of-author-item">
                  <a href="https://github.com/mengdaya" target="_blank" title="GitHub">
                    
                      <i class="fa fa-fw fa-github"></i>GitHub</a>
                </span>
              
                <span class="links-of-author-item">
                  <a href="mailto:yourname@gmail.com" target="_blank" title="E-Mail">
                    
                      <i class="fa fa-fw fa-envelope"></i>E-Mail</a>
                </span>
              
            
          </div>

          
          

          
          
            <div class="links-of-blogroll motion-element links-of-blogroll-inline">
              <div class="links-of-blogroll-title">
                <i class="fa  fa-fw fa-globe"></i>
                友情链接
              </div>
              <ul class="links-of-blogroll-list">
                
                  <li class="links-of-blogroll-item">
                    <a href="https://www.ibm.com/developerworks/cn/" title="IBM developerWorks" target="_blank">IBM developerWorks</a>
                  </li>
                
                  <li class="links-of-blogroll-item">
                    <a href="http://iissnan.com/progit/" title="Pro Git" target="_blank">Pro Git</a>
                  </li>
                
                  <li class="links-of-blogroll-item">
                    <a href="http://www.freeoa.net/index/" title="freeOA" target="_blank">freeOA</a>
                  </li>
                
                  <li class="links-of-blogroll-item">
                    <a href="http://www.ttlsa.com/" title="运维生存时间" target="_blank">运维生存时间</a>
                  </li>
                
                  <li class="links-of-blogroll-item">
                    <a href="http://www.361way.com/" title="运维之路" target="_blank">运维之路</a>
                  </li>
                
                  <li class="links-of-blogroll-item">
                    <a href="http://www.yiibai.com/" title="易百教程" target="_blank">易百教程</a>
                  </li>
                
                  <li class="links-of-blogroll-item">
                    <a href="http://www.centoscn.com/" title="CentOS中文站" target="_blank">CentOS中文站</a>
                  </li>
                
                  <li class="links-of-blogroll-item">
                    <a href="http://www.linuxprobe.com/" title="Linux就该这么学" target="_blank">Linux就该这么学</a>
                  </li>
                
                  <li class="links-of-blogroll-item">
                    <a href="http://www.netingcn.com/" title="网络进行时" target="_blank">网络进行时</a>
                  </li>
                
                  <li class="links-of-blogroll-item">
                    <a href="http://www.ruanyifeng.com/blog/" title="阮一峰的网络日志" target="_blank">阮一峰的网络日志</a>
                  </li>
                
                  <li class="links-of-blogroll-item">
                    <a href="https://www.liaoxuefeng.com" title="廖雪峰的官方网站" target="_blank">廖雪峰的官方网站</a>
                  </li>
                
                  <li class="links-of-blogroll-item">
                    <a href="https://yihui.name/cn/" title="谢益辉的博客" target="_blank">谢益辉的博客</a>
                  </li>
                
                  <li class="links-of-blogroll-item">
                    <a href="https://coolshell.cn" title="酷壳" target="_blank">酷壳</a>
                  </li>
                
              </ul>
            </div>
          

          

        </div>
      </section>

      
      <!--noindex-->
        <section class="post-toc-wrap motion-element sidebar-panel sidebar-panel-active">
          <div class="post-toc">

            
              
            

            
              <div class="post-toc-content"><ol class="nav"><li class="nav-item nav-level-1"><a class="nav-link" href="#Dnsmasq-的应用"><span class="nav-number">1.</span> <span class="nav-text">Dnsmasq 的应用</span></a></li><li class="nav-item nav-level-1"><a class="nav-link" href="#Dnsmasq-基本的工作原理"><span class="nav-number">2.</span> <span class="nav-text">Dnsmasq 基本的工作原理</span></a></li><li class="nav-item nav-level-1"><a class="nav-link" href="#安装-Dnsmasq"><span class="nav-number">3.</span> <span class="nav-text">安装 Dnsmasq</span></a></li><li class="nav-item nav-level-1"><a class="nav-link" href="#配置-Dnsmasq"><span class="nav-number">4.</span> <span class="nav-text">配置 Dnsmasq</span></a><ol class="nav-child"><li class="nav-item nav-level-2"><a class="nav-link" href="#DNS-配置参数说明"><span class="nav-number">4.1.</span> <span class="nav-text">DNS 配置参数说明</span></a></li><li class="nav-item nav-level-2"><a class="nav-link" href="#DNS配置实例"><span class="nav-number">4.2.</span> <span class="nav-text">DNS配置实例</span></a><ol class="nav-child"><li class="nav-item nav-level-3"><a class="nav-link" href="#基本配置"><span class="nav-number">4.2.1.</span> <span class="nav-text">基本配置</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#配置DNS（缓存）服务器"><span class="nav-number">4.2.2.</span> <span class="nav-text">配置DNS（缓存）服务器</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#配置域名劫持"><span class="nav-number">4.2.3.</span> <span class="nav-text">配置域名劫持</span></a><ol class="nav-child"><li class="nav-item nav-level-4"><a class="nav-link" href="#使用hosts配置域名劫持"><span class="nav-number">4.2.3.1.</span> <span class="nav-text">使用hosts配置域名劫持</span></a></li><li class="nav-item nav-level-4"><a class="nav-link" href="#使用address配置域名劫持"><span class="nav-number">4.2.3.2.</span> <span class="nav-text">使用address配置域名劫持</span></a></li></ol></li><li class="nav-item nav-level-3"><a class="nav-link" href="#生产环境中的DNS拦截使用"><span class="nav-number">4.2.4.</span> <span class="nav-text">生产环境中的DNS拦截使用</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#泛域名配置应用"><span class="nav-number">4.2.5.</span> <span class="nav-text">泛域名配置应用</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#选择最快的上游DNS服务器"><span class="nav-number">4.2.6.</span> <span class="nav-text">选择最快的上游DNS服务器</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#Dnsmasq-性能优化"><span class="nav-number">4.2.7.</span> <span class="nav-text">Dnsmasq 性能优化</span></a></li></ol></li><li class="nav-item nav-level-2"><a class="nav-link" href="#DHCP配置参数说明"><span class="nav-number">4.3.</span> <span class="nav-text">DHCP配置参数说明</span></a></li><li class="nav-item nav-level-2"><a class="nav-link" href="#DHCP配置实例"><span class="nav-number">4.4.</span> <span class="nav-text">DHCP配置实例</span></a></li></ol></li><li class="nav-item nav-level-1"><a class="nav-link" href="#web端的配置"><span class="nav-number">5.</span> <span class="nav-text">web端的配置</span></a><ol class="nav-child"><li class="nav-item nav-level-2"><a class="nav-link" href="#dnsmasq命令选项说明"><span class="nav-number">5.1.</span> <span class="nav-text">dnsmasq命令选项说明</span></a></li></ol></li><li class="nav-item nav-level-1"><a class="nav-link" href="#参考链接"><span class="nav-number">6.</span> <span class="nav-text">参考链接</span></a></li></ol></div>
            

          </div>
        </section>
      <!--/noindex-->
      

      

    </div>
  </aside>


        
      </div>
    </main>

    <footer id="footer" class="footer">
      <div class="footer-inner">
        <div class="copyright">&copy; 2015 &mdash; <span itemprop="copyrightYear">2018</span>
  <span class="with-love">
    <i class="fa fa-user"></i>
  </span>
  <span class="author" itemprop="copyrightHolder">文章总结于网络，转载请注明出处</span>

  
</div>









        
<div class="busuanzi-count">
  <script async src="https://dn-lbstatics.qbox.me/busuanzi/2.3/busuanzi.pure.mini.js"></script>

  
    <span class="site-uv">
      <i class="fa fa-user">本站访客</i>
      <span class="busuanzi-value" id="busuanzi_value_site_uv"></span>
      人
    </span>
  

  
    <span class="site-pv">
      <i class="fa fa-eye">本站总访问量</i>
      <span class="busuanzi-value" id="busuanzi_value_site_pv"></span>
      次
    </span>
  
</div>








        
      </div>
    </footer>

    
      <div class="back-to-top">
        <i class="fa fa-arrow-up"></i>
        
      </div>
    

  </div>

  

<script type="text/javascript">
  if (Object.prototype.toString.call(window.Promise) !== '[object Function]') {
    window.Promise = null;
  }
</script>









  


  











  
  <script type="text/javascript" src="/lib/jquery/index.js?v=2.1.3"></script>

  
  <script type="text/javascript" src="/lib/fastclick/lib/fastclick.min.js?v=1.0.6"></script>

  
  <script type="text/javascript" src="/lib/jquery_lazyload/jquery.lazyload.js?v=1.9.7"></script>

  
  <script type="text/javascript" src="/lib/velocity/velocity.min.js?v=1.2.1"></script>

  
  <script type="text/javascript" src="/lib/velocity/velocity.ui.min.js?v=1.2.1"></script>

  
  <script type="text/javascript" src="/lib/fancybox/source/jquery.fancybox.pack.js?v=2.1.5"></script>

  
  <script type="text/javascript" src="true"></script>


  


  <script type="text/javascript" src="/js/src/utils.js?v=5.1.3"></script>

  <script type="text/javascript" src="/js/src/motion.js?v=5.1.3"></script>



  
  

  
  <script type="text/javascript" src="/js/src/scrollspy.js?v=5.1.3"></script>
<script type="text/javascript" src="/js/src/post-details.js?v=5.1.3"></script>



  


  <script type="text/javascript" src="/js/src/bootstrap.js?v=5.1.3"></script>



  


  




	





  





  








  

  <script type="text/javascript">
    // Popup Window;
    var isfetched = false;
    var isXml = true;
    // Search DB path;
    var search_path = "search.xml";
    if (search_path.length === 0) {
      search_path = "search.xml";
    } else if (/json$/i.test(search_path)) {
      isXml = false;
    }
    var path = "/" + search_path;
    // monitor main search box;

    var onPopupClose = function (e) {
      $('.popup').hide();
      $('#local-search-input').val('');
      $('.search-result-list').remove();
      $('#no-result').remove();
      $(".local-search-pop-overlay").remove();
      $('body').css('overflow', '');
    }

    function proceedsearch() {
      $("body")
        .append('<div class="search-popup-overlay local-search-pop-overlay"></div>')
        .css('overflow', 'hidden');
      $('.search-popup-overlay').click(onPopupClose);
      $('.popup').toggle();
      var $localSearchInput = $('#local-search-input');
      $localSearchInput.attr("autocapitalize", "none");
      $localSearchInput.attr("autocorrect", "off");
      $localSearchInput.focus();
    }

    // search function;
    var searchFunc = function(path, search_id, content_id) {
      'use strict';

      // start loading animation
      $("body")
        .append('<div class="search-popup-overlay local-search-pop-overlay">' +
          '<div id="search-loading-icon">' +
          '<i class="fa fa-spinner fa-pulse fa-5x fa-fw"></i>' +
          '</div>' +
          '</div>')
        .css('overflow', 'hidden');
      $("#search-loading-icon").css('margin', '20% auto 0 auto').css('text-align', 'center');

      $.ajax({
        url: path,
        dataType: isXml ? "xml" : "json",
        async: true,
        success: function(res) {
          // get the contents from search data
          isfetched = true;
          $('.popup').detach().appendTo('.header-inner');
          var datas = isXml ? $("entry", res).map(function() {
            return {
              title: $("title", this).text(),
              content: $("content",this).text(),
              url: $("url" , this).text()
            };
          }).get() : res;
          var input = document.getElementById(search_id);
          var resultContent = document.getElementById(content_id);
          var inputEventFunction = function() {
            var searchText = input.value.trim().toLowerCase();
            var keywords = searchText.split(/[\s\-]+/);
            if (keywords.length > 1) {
              keywords.push(searchText);
            }
            var resultItems = [];
            if (searchText.length > 0) {
              // perform local searching
              datas.forEach(function(data) {
                var isMatch = false;
                var hitCount = 0;
                var searchTextCount = 0;
                var title = data.title.trim();
                var titleInLowerCase = title.toLowerCase();
                var content = data.content.trim().replace(/<[^>]+>/g,"");
                var contentInLowerCase = content.toLowerCase();
                var articleUrl = decodeURIComponent(data.url);
                var indexOfTitle = [];
                var indexOfContent = [];
                // only match articles with not empty titles
                if(title != '') {
                  keywords.forEach(function(keyword) {
                    function getIndexByWord(word, text, caseSensitive) {
                      var wordLen = word.length;
                      if (wordLen === 0) {
                        return [];
                      }
                      var startPosition = 0, position = [], index = [];
                      if (!caseSensitive) {
                        text = text.toLowerCase();
                        word = word.toLowerCase();
                      }
                      while ((position = text.indexOf(word, startPosition)) > -1) {
                        index.push({position: position, word: word});
                        startPosition = position + wordLen;
                      }
                      return index;
                    }

                    indexOfTitle = indexOfTitle.concat(getIndexByWord(keyword, titleInLowerCase, false));
                    indexOfContent = indexOfContent.concat(getIndexByWord(keyword, contentInLowerCase, false));
                  });
                  if (indexOfTitle.length > 0 || indexOfContent.length > 0) {
                    isMatch = true;
                    hitCount = indexOfTitle.length + indexOfContent.length;
                  }
                }

                // show search results

                if (isMatch) {
                  // sort index by position of keyword

                  [indexOfTitle, indexOfContent].forEach(function (index) {
                    index.sort(function (itemLeft, itemRight) {
                      if (itemRight.position !== itemLeft.position) {
                        return itemRight.position - itemLeft.position;
                      } else {
                        return itemLeft.word.length - itemRight.word.length;
                      }
                    });
                  });

                  // merge hits into slices

                  function mergeIntoSlice(text, start, end, index) {
                    var item = index[index.length - 1];
                    var position = item.position;
                    var word = item.word;
                    var hits = [];
                    var searchTextCountInSlice = 0;
                    while (position + word.length <= end && index.length != 0) {
                      if (word === searchText) {
                        searchTextCountInSlice++;
                      }
                      hits.push({position: position, length: word.length});
                      var wordEnd = position + word.length;

                      // move to next position of hit

                      index.pop();
                      while (index.length != 0) {
                        item = index[index.length - 1];
                        position = item.position;
                        word = item.word;
                        if (wordEnd > position) {
                          index.pop();
                        } else {
                          break;
                        }
                      }
                    }
                    searchTextCount += searchTextCountInSlice;
                    return {
                      hits: hits,
                      start: start,
                      end: end,
                      searchTextCount: searchTextCountInSlice
                    };
                  }

                  var slicesOfTitle = [];
                  if (indexOfTitle.length != 0) {
                    slicesOfTitle.push(mergeIntoSlice(title, 0, title.length, indexOfTitle));
                  }

                  var slicesOfContent = [];
                  while (indexOfContent.length != 0) {
                    var item = indexOfContent[indexOfContent.length - 1];
                    var position = item.position;
                    var word = item.word;
                    // cut out 100 characters
                    var start = position - 20;
                    var end = position + 80;
                    if(start < 0){
                      start = 0;
                    }
                    if (end < position + word.length) {
                      end = position + word.length;
                    }
                    if(end > content.length){
                      end = content.length;
                    }
                    slicesOfContent.push(mergeIntoSlice(content, start, end, indexOfContent));
                  }

                  // sort slices in content by search text's count and hits' count

                  slicesOfContent.sort(function (sliceLeft, sliceRight) {
                    if (sliceLeft.searchTextCount !== sliceRight.searchTextCount) {
                      return sliceRight.searchTextCount - sliceLeft.searchTextCount;
                    } else if (sliceLeft.hits.length !== sliceRight.hits.length) {
                      return sliceRight.hits.length - sliceLeft.hits.length;
                    } else {
                      return sliceLeft.start - sliceRight.start;
                    }
                  });

                  // select top N slices in content

                  var upperBound = parseInt('1');
                  if (upperBound >= 0) {
                    slicesOfContent = slicesOfContent.slice(0, upperBound);
                  }

                  // highlight title and content

                  function highlightKeyword(text, slice) {
                    var result = '';
                    var prevEnd = slice.start;
                    slice.hits.forEach(function (hit) {
                      result += text.substring(prevEnd, hit.position);
                      var end = hit.position + hit.length;
                      result += '<b class="search-keyword">' + text.substring(hit.position, end) + '</b>';
                      prevEnd = end;
                    });
                    result += text.substring(prevEnd, slice.end);
                    return result;
                  }

                  var resultItem = '';

                  if (slicesOfTitle.length != 0) {
                    resultItem += "<li><a href='" + articleUrl + "' class='search-result-title'>" + highlightKeyword(title, slicesOfTitle[0]) + "</a>";
                  } else {
                    resultItem += "<li><a href='" + articleUrl + "' class='search-result-title'>" + title + "</a>";
                  }

                  slicesOfContent.forEach(function (slice) {
                    resultItem += "<a href='" + articleUrl + "'>" +
                      "<p class=\"search-result\">" + highlightKeyword(content, slice) +
                      "...</p>" + "</a>";
                  });

                  resultItem += "</li>";
                  resultItems.push({
                    item: resultItem,
                    searchTextCount: searchTextCount,
                    hitCount: hitCount,
                    id: resultItems.length
                  });
                }
              })
            };
            if (keywords.length === 1 && keywords[0] === "") {
              resultContent.innerHTML = '<div id="no-result"><i class="fa fa-search fa-5x" /></div>'
            } else if (resultItems.length === 0) {
              resultContent.innerHTML = '<div id="no-result"><i class="fa fa-frown-o fa-5x" /></div>'
            } else {
              resultItems.sort(function (resultLeft, resultRight) {
                if (resultLeft.searchTextCount !== resultRight.searchTextCount) {
                  return resultRight.searchTextCount - resultLeft.searchTextCount;
                } else if (resultLeft.hitCount !== resultRight.hitCount) {
                  return resultRight.hitCount - resultLeft.hitCount;
                } else {
                  return resultRight.id - resultLeft.id;
                }
              });
              var searchResultList = '<ul class=\"search-result-list\">';
              resultItems.forEach(function (result) {
                searchResultList += result.item;
              })
              searchResultList += "</ul>";
              resultContent.innerHTML = searchResultList;
            }
          }

          if ('auto' === 'auto') {
            input.addEventListener('input', inputEventFunction);
          } else {
            $('.search-icon').click(inputEventFunction);
            input.addEventListener('keypress', function (event) {
              if (event.keyCode === 13) {
                inputEventFunction();
              }
            });
          }

          // remove loading animation
          $(".local-search-pop-overlay").remove();
          $('body').css('overflow', '');

          proceedsearch();
        }
      });
    }

    // handle and trigger popup window;
    $('.popup-trigger').click(function(e) {
      e.stopPropagation();
      if (isfetched === false) {
        searchFunc(path, 'local-search-input', 'local-search-result');
      } else {
        proceedsearch();
      };
    });

    $('.popup-btn-close').click(onPopupClose);
    $('.popup').click(function(e){
      e.stopPropagation();
    });
    $(document).on('keyup', function (event) {
      var shouldDismissSearchPopup = event.which === 27 &&
        $('.search-popup').is(':visible');
      if (shouldDismissSearchPopup) {
        onPopupClose();
      }
    });
  </script>





  

  
<script>
(function(){
    var bp = document.createElement('script');
    var curProtocol = window.location.protocol.split(':')[0];
    if (curProtocol === 'https') {
        bp.src = 'https://zz.bdstatic.com/linksubmit/push.js';        
    }
    else {
        bp.src = 'http://push.zhanzhang.baidu.com/push.js';
    }
    var s = document.getElementsByTagName("script")[0];
    s.parentNode.insertBefore(bp, s);
})();
</script>


  

  

  

  

</body>
</html>
